Login Request a demo
CR
Vendor
craftcms
10 products with CVEs on record
269
CVEs
7
On KEV
17
New 30D
Products
CM
cms
craftcms
10.0
128 CVEs3 on KEV16 new
CO
commerce-mollie
craftcms
7.5
1 CVEs0 on KEV1 new
CC
Craft Cms
Craftcms
10.0
97 CVEs4 on KEV0 new
CO
commerce
craftcms
8.8
21 CVEs0 on KEV0 new
CC
Craft Commerce
Craftcms
8.8
17 CVEs0 on KEV0 new
AW
aws-s3
craftcms
6.9
1 CVEs0 on KEV0 new
AZ
azure-blob
craftcms
8.7
1 CVEs0 on KEV0 new
CR
CraftCMS
CraftCMS
9.8
1 CVEs0 on KEV0 new
GO
google-cloud
craftcms
2.4
1 CVEs0 on KEV0 new
WE
webhooks
craftcms
8.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-115938
New
CM
cms
craftcms
8.8
0%
Oct 23Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
CVE-2026-115937
New
CO
commerce-mollie
craftcms
7.5
0%
Oct 23Unauthenticated payment reuse allows unpaid orders to be marked as paid
CVE-2026-115935
New
CM
cms
craftcms
8.8
0%
Oct 23Control panel only API response emulation replaces "securityKey" and reaches server RCE
CVE-2026-112777
CM
cms
craftcms
7.2
1%
Oct 19Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
CVE-2026-112776
CM
cms
craftcms
9.8
0%
Oct 19Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
CVE-2026-112775
CM
cms
craftcms
7.5
0%
Oct 19Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
CVE-2026-112774
CM
cms
craftcms
7.2
1%
Oct 19Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout
CVE-2026-112773
CM
cms
craftcms
8.8
1%
Oct 19Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
CVE-2026-112772
CM
cms
craftcms
8.8
1%
Oct 19Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
CVE-2026-112771
CM
cms
craftcms
6.5
0%
Oct 19Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
CVE-2026-112770
CM
cms
craftcms
8.8
1%
Oct 19Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable
CVE-2026-109308
CM
cms
craftcms
8.8
0%
Oct 12Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
CVE-2026-109307
CM
cms
craftcms
4.7
0%
Oct 12Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
CVE-2026-109306
CM
cms
craftcms
5.9
0%
Oct 12Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
CVE-2026-109305
CM
cms
craftcms
8.8
0%
Oct 12Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
CVE-2026-109304
CM
cms
craftcms
4.9
0%
Oct 12Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
CVE-2026-105985
CM
cms
craftcms
8.8
1%
Oct 6Authenticated RCE via render-components Entry Type overrides
CVE-2026-92594
CM
cms
craftcms
7.5
0%
Sep 16Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
CVE-2026-92593
CM
cms
craftcms
8.8
1%
Sep 16Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution
CVE-2026-92592
CM
cms
craftcms
8.8
1%
Sep 16Craft CMS before 4.18.6 Remote Code Execution via signed cookie
CVE-2026-92591
CM
cms
craftcms
5.9
0%
Sep 16Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
CVE-2026-92590
CM
cms
craftcms
5.4
0%
Sep 16Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
CVE-2026-92589
CM
cms
craftcms
4.3
0%
Sep 16Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder
CVE-2026-55795
CO
commerce
craftcms
6.9
1%
Sep 14Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
CVE-2026-79987
CM
cms
craftcms
8.8
1%
Sep 10Low-privilege RCE through element-search eager loading
CVE-2026-86732
CM
cms
craftcms
8.8
1%
Sep 8Craft CMS before 5.10.12 Remote Code Execution via element-index
CVE-2026-86731
CM
cms
craftcms
6.5
0%
Sep 8Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController
CVE-2026-86730
CM
cms
craftcms
8.8
1%
Sep 8Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
CVE-2026-79991
CM
cms
craftcms
7.1
1%
Sep 2Authenticated SQL Injection via nested eager-loading criteria
CVE-2026-79990
CM
cms
craftcms
8.7
0%
Sep 2GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
CVE-2026-79989
CM
cms
craftcms
8.7
0%
Sep 2Arbitrary user password reset leading to administrator account takeover
CVE-2026-84802
CM
cms
craftcms
4.3
0%
Sep 2Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
CVE-2026-84801
CM
cms
craftcms
8.8
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
CVE-2026-84800
CM
cms
craftcms
7.1
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
CVE-2026-84799
CM
cms
craftcms
4.3
0%
Sep 2Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations
CVE-2026-84798
CM
cms
craftcms
7.1
0%
Sep 2Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
CVE-2026-84797
CM
cms
craftcms
6.3
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate
CVE-2026-84796
CM
cms
craftcms
8.8
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
CVE-2026-84795
CM
cms
craftcms
9.8
1%
Sep 2Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
CVE-2026-84794
CM
cms
craftcms
7.1
0%
Sep 2Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
CVE-2026-84793
CM
cms
craftcms
4.8
0%
Sep 2Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
CVE-2026-84792
CM
cms
craftcms
4.3
0%
Sep 2Craft CMS before 5.10.11 Broken Access Control via element-indexes
CVE-2026-79988
CM
cms
craftcms
8.7
0%
Aug 27Authenticated RCE through Twig sandbox escape
CVE-2026-78416
CM
cms
craftcms
8.7
1%
Aug 24Authenticated RCE via `condition.config` JSON cleanse bypass
CVE-2026-72787
CM
cms
craftcms
6.4
0%
Aug 12Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name
CVE-2026-72786
CM
cms
craftcms
6.5
0%
Aug 12Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset
CVE-2026-72785
CM
cms
craftcms
4.3
0%
Aug 11Craft CMS before 5.10.6 Authorization Bypass via structures/move-element
CVE-2026-72784
CM
cms
craftcms
5.4
0%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation
CVE-2026-72783
CM
cms
craftcms
6.2
0%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained
CVE-2026-72782
CM
cms
craftcms
6.5
0%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak
CVE-2026-72781
CM
cms
craftcms
8.8
1%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
CVE-2026-72780
CM
cms
craftcms
6.5
0%
Aug 11Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
CVE-2026-72779
CM
cms
craftcms
4.5
0%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
CVE-2026-72778
CM
cms
craftcms
8.8
1%
Aug 11Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
CVE-2026-50282
CM
cms
craftcms
4.9
0%
Jul 2Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves
CVE-2026-50281
CM
cms
craftcms
7.1
0%
Jul 2Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
CVE-2026-50280
CM
cms
craftcms
6.0
0%
Jul 1Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
CVE-2026-50279
CM
cms
craftcms
7.6
0%
Jul 1Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
CVE-2026-55794
CM
cms
craftcms
8.7
0%
Jul 1Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
CVE-2026-55792
CM
cms
craftcms
6.0
0%
Jul 1Craft CMS: Sensitive File Disclosure / Server-Side File Read